Security Controls Review

The Centre for Internet Security (CIS) publishes a are a set of globally recognized cybersecurity best practices that are designed to help organizations of all sizes and types protect their critical assets from cyber threats, known as the CIS Critical Security Controls.
The CIS Controls provide a prioritized approach to cybersecurity, focusing on the most critical areas organizations should address to improve their security posture. They cover a wide range of security domains, including asset management, access control, network security, and incident response.

By using security benchmarks such as the CIS Controls, organizations can benchmark their security posture against industry best practices, identify gaps in their cybersecurity controls, and develop a roadmap for improving their overall security posture. In addition, using security benchmarks such as the CIS Controls can help organizations meet regulatory compliance requirements, such as those outlined in GDPR, HIPAA, and PCI DSS.

CIS describes three Implementation Groups that give increasing levels of protection.

• Implementation Group 1 – Controls for small, commercial off-the-shelf, or home office software environments. For small to medium-sized organisations with limited IT and cybersecurity expertise and low-sensitivity data. They are designed to thwart general, non-targeted attacks.
• Implementation Group 2 – Controls for IT departments that manage sensitive client or company information, particularly those with regulatory compliance requirements. Some controls require enterprise-grade technology and specialised expertise to install correctly.
• Implementation Group 3 – Controls to reduce the impact of zero-day attacks and targeted attacks from sophisticated adversaries. They are designed to protect sensitive data that could have a significant public impact if released.

We will audit your IT against the CIS Implementation Group 1 controls. This audit aims to provide your senior management with independent external validation that the CIS controls you have implemented appropriately.

Our analysts will use the following techniques:

•  Interviews with key staff.
• review of documented procedures and policies
• review of the evidence (e.g. screenshots or documents) that demonstrates the established guidelines are being followed
• direct inspection of the system (where permitted)

Evidence will be collected using a risk-based approach, covering at least 25% of the controls.

Our report will include:

• The scope of systems included within the audit
• An executive summary of the findings and any major non-compliances
• The sources of data used to construct the report
• A record of each CIS control, whether:
  • The extent to which the policy is documented
  • The extent to which the control is implemented
  • The extent to which the control is technically enforced, or automated
  • The evidence that was collected to supports the conclusions
• Prioritised recommendations for improvements